ESET reports SparroWocky backdoor in FamousSparrow attacks

Security researchers at ESET have documented a previously unreported SparroWocky backdoor in attacks against targets in several Latin American countries. A backdoor is malicious software that gives an intruder remote control of an infected computer while trying to stay hidden from its owner and from security tools. The technical report, shared with The Hacker News ahead of publication by ESET researchers Alexandre Côté Cyr and Romain Dumont, says the malware has been in use against targets in the region since at least August 2025.

ESET describes SparroWocky as a modular backdoor written in C++, which means it is assembled from separate parts that its operators can add, remove or replace, and it is coded in one of the most widely used languages for Windows software. The researchers said the architecture of the malware, and the techniques chosen by its authors, point to strong knowledge of anti-analysis tricks, the methods malware uses to avoid being spotted and studied, and of Windows internals, the inner workings of the operating system that runs on most business desktops and servers.

The tool is attributed to a threat actor, the industry term for a person or group that carries out cyberattacks, that ESET names FamousSparrow. The report describes the group as state sponsored and aligned with China, and assesses that it has been active since at least 2019. ESET says the group shares some level of overlap with two other tracked clusters of activity, Earth Estries and Salt Typhoon. SparroWocky has now replaced SparrowDoor as the group's primary implant, the term for the part of a piece of malware that stays quietly on a victim's machine and waits for orders from its operators. The unusual name comes from early versions of the code, which contained the first stanza of Jabberwocky, a nonsense poem by the English author, poet and mathematician Lewis Carroll, written around 1855.

SparroWocky can carry out a broad set of tasks once it is running on a machine. It can execute arbitrary files, meaning any program its operators choose to send, act as a TCP proxy (a relay that lets traffic pass through the infected machine, for instance to reach other systems in the same network), and run commands that the operator types. It can collect general information about the compromised computer and the IP addresses of its network interfaces, the numeric addresses that identify it on a network. It can also exfiltrate files, which means copying them out to the attackers' own systems, take screenshots at regular intervals, perform file operations such as moving or deleting data, and finally delete itself from the host, a step that makes the intrusion harder to investigate afterwards.

One of the more notable findings concerns how the group builds its tools. SparroWocky leans on several public, open-source projects, which are pieces of software whose code is published for anyone to reuse. It uses Mbed TLS, a library for encrypted connections, to set up a secure TLS channel with its command-and-control server at 216.238.110[.]120. A command-and-control server is the remote system an infected machine contacts to receive instructions, and TLS is the same encryption technology that protects ordinary web browsing, used here to make malicious traffic look unremarkable. The malware also uses MinHook to hide the starting address of newly created threads (a thread is a small unit of work inside a program) from security products, and a COFF Loader to load and run extra plugins in memory as COFF objects, a Windows format for compiled code, so components can be swapped in without writing files to disk. It uses a variant of a technique called SilentMoonwalk, or StackMoonwalk, to spoof call stacks, the chain of function calls a program leaves behind, originating from the MinHook routines.

"FamousSparrow still uses open-source offensive tooling for its own malicious ends," ESET said in the report. "Previously, these tools were mainly used side by side with the group's backdoor. With SparroWocky, we can observe that it also has the development capabilities to integrate open-source code directly into its own custom backdoor."

Even though the malware family has changed, ESET says the underlying techniques have stayed the same. As with SparrowDoor, SparroWocky is triggered through a DLL sideloading chain. A DLL is a file of ready-made code that a Windows program loads when it needs extra functions, and sideloading means tricking a trusted program into loading a malicious DLL planted next to it. In this chain, a legitimate executable is used to launch a loader DLL, which then decrypts and starts the main payload, so the real malicious code never sits on a disk in an obviously readable form. ESET says the initial access vector, the way the attackers first got into these networks, is unknown.

FamousSparrow appears to have sharpened its focus on high-profile targets in Latin America from July 2025. According to ESET, the new backdoor was deployed against governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela, and 90 per cent of the group's targets recorded in the company's telemetry, the data it gathers from systems running its products, were located in that region. The Slovak cybersecurity company said it is not clear whether the group's apparent focus on Latin America reflects a formal, geographical mandate, or whether it is temporary and driven by current geopolitical circumstances.

For website owners, IT teams and businesses outside the region, the immediate relevance is the technique rather than the target list. DLL sideloading abuses software that users already trust, so it can slip past tools that only look for obviously malicious downloads, and the report names no specific software vulnerability that organisations can simply patch, because the initial access route is still unconfirmed. That makes basic hygiene the practical answer: keeping systems and applications updated, limiting what employees are allowed to download and run, and keeping security software current and monitored. Organisations that want help hardening their own infrastructure can look at what AEU-I describes as security-first IT, infrastructure and consulting, with the details published on its service page.